350-401 Security Practice Test 7 — 15 Questions

Question 1

Which THREE of the following are characteristics of Cisco TrustSec (CTS) security architecture?

Accepted Answer

It uses Security Group Tags (SGTs) to classify traffic.. C is correct because Cisco TrustSec uses Security Group Tags (SGTs) to classify traffic based on user, device, or role, rather than IP addresses. SGTs are 16-bit values (0–65535) assigned dynamically via authentication (e.g., 802.1X) or static mapping, enabling scalable policy enforcement.

Answer

It uses IPsec to encrypt traffic between network devices.

Answer

It uses VLANs to segment traffic based on security roles.

Question 2

Refer to the exhibit. A network administrator notices that some DHCP packets are being dropped due to 'MAC Address Mismatch'. What is the most likely cause of this drop?

Accepted Answer

The DHCP client is using a different MAC address in the DHCP packet than the source MAC in the Ethernet frame.. The DHCP snooping feature on a switch compares the source MAC address in the Ethernet frame with the chaddr (client hardware address) field inside the DHCP packet. When a DHCP client sends a packet with a different MAC in the frame than in the chaddr field, the switch considers it a 'MAC Address Mismatch' and drops the packet. This security mechanism prevents a rogue client from spoofing another device's MAC address to obtain a lease.

Answer

The DHCP server is sending packets with an incorrect server identifier option.

Answer

The DHCP client is sending a request with an incorrect transaction ID.

Answer

The DHCP offer packet is arriving on an untrusted port.

Question 3

Refer to the exhibit. A switch has IP Source Guard (IPSG) and port-security enabled on interface GigabitEthernet0/1. A host with IP 10.1.1.1 and MAC 00:1A:2B:3C:4D:5E is connected and tries to access a web server at 192.168.1.100. What will happen?

Accepted Answer

The traffic is blocked because IP Source Guard requires a static binding for the host.. IP Source Guard (IPSG) validates the source IP address of traffic using DHCP snooping bindings or static IP-source bindings. In this scenario, no DHCP snooping binding exists (host is not using DHCP) and no static binding has been configured, so IPSG will drop the traffic from the host. Port-security ensures the source MAC is valid, but does not provide the IP-MAC binding required by IPSG. Therefore, the traffic is blocked.

Answer

The traffic is blocked because the host is not using DHCP, so IPSG drops all non-DHCP traffic.

Answer

The traffic is permitted only if the destination is also in the 10.0.0.0/8 range.

Answer

The traffic is permitted because the host's IP is within the allowed subnet and the MAC is valid according to port-security.

Question 4

A medium-sized enterprise is migrating to a Cisco DNA Center-managed network. The security policy requires that all administrative access to network devices be authenticated via TACACS+ and that authorization for commands be enforced per user role. The network team has configured ISE as the AAA server and integrated it with DNA Center. After configuration, engineers report that they can log in to devices via SSH but are not prompted for a password when entering 'enable' mode; instead, they are granted full privileges immediately. Additionally, while in configuration mode, some engineers can issue 'debug' commands that they should not have access to. The configuration on the devices includes 'aaa new-model', 'aaa authentication login default group tacacs+ local', 'aaa authorization exec default group tacacs+ local', and 'aaa authorization commands 15 default group tacacs+ local'. What is the most likely cause of the privilege escalation and missing authorization?

Accepted Answer

The 'aaa authentication enable default' command is missing, so the device is not requiring authentication to enter enable mode, and command authorization is not being enforced because the user is already at privilege 15.. The missing 'aaa authentication enable default group tacacs+ local' command means the device does not require TACACS+ authentication to enter enable mode. Since the user is already at privilege level 15 after login (due to the 'aaa authorization exec' command or local user configuration), they are not prompted for a password and are granted full privileges immediately. Additionally, command authorization is only configured for privilege level 15 ('aaa authorization commands 15'), so once the user is at level 15, no further authorization checks are performed for commands like 'debug', bypassing the intended per-role enforcement.

Answer

The TACACS+ server is not reachable, so the device is using local authentication, but the local database has all users at privilege level 15.

Answer

Command authorization is only configured for privilege level 15, but users are logging in at level 1; they need 'aaa authorization commands 1 default' as well.

Answer

The 'privilege level' command is set to 15 on the VTY lines, bypassing AAA authorization.

Question 5

Which TWO features are part of Cisco TrustSec for providing role-based access control?

Accepted Answer

Security Group Access Control Lists (SGACLs). Security Group Access Control Lists (SGACLs) are a core component of Cisco TrustSec, enforcing role-based access control by applying policies based on Security Group Tags (SGTs). SGACLs replace traditional IP-based ACLs, allowing dynamic, identity-aware traffic filtering that scales across the network.

Answer

Change of Authorization (CoA)

Answer

802.1X authentication

Answer

MACsec encryption

Question 6

A network engineer applies the above CoPP policy on a router. The router has BGP peers, SSH management, and SNMP monitoring. After applying this policy, which traffic will be affected?

Accepted Answer

BGP sessions may flap due to dropped keepalives.. The CoPP policy applies to control plane traffic, not data plane traffic. BGP keepalives are control plane packets; if the policy drops or rate-limits them, BGP sessions may time out and flap. The correct answer is A because BGP keepalives are essential for maintaining neighbor adjacency, and dropping them directly causes session instability.

Answer

Data plane traffic will be dropped.

Answer

Only SSH sessions will be rate-limited.

Answer

SNMP and SSH will be unaffected because they are explicitly permitted.

Question 7

Drag and drop the steps to configure port security on a Cisco switch in the correct order.

Accepted Answer

Step 1: Enable port security (switchport port-security), Step 2: Set maximum MAC addresses (switchport port-security maximum), Step 3: Define secure MAC addresses (switchport port-security mac-address sticky or static), Step 4: Configure violation mode (switchport port-security violation shutdown/restrict/protect). Port security limits unauthorized MAC addresses; violation mode defines action on violation.

Answer

Step 1: Set maximum MAC addresses, Step 2: Enable port security, Step 3: Define secure MAC addresses, Step 4: Configure violation mode

Answer

Step 1: Configure violation mode, Step 2: Enable port security, Step 3: Set maximum MAC addresses, Step 4: Define secure MAC addresses

Answer

Step 1: Enable port security, Step 2: Define secure MAC addresses, Step 3: Set maximum MAC addresses, Step 4: Configure violation mode

Question 8

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router that runs BGP, SSH management, and SNMP polling. A class-map named CLASS-MGMT matches SNMP and SSH traffic, and a policy-map named COPP-POLICY applies a police rate of 8000 bps with a conform-action transmit and exceed-action drop for that class. After the policy is attached to the control plane, SNMP polling intermittently fails while BGP remains stable. Which action should the engineer take to resolve the SNMP failures while still protecting the route processor?

Accepted Answer

Increase the police rate in the CLASS-MGMT class to a value that accommodates the normal SNMP and SSH burst rate.. SNMP polling is bursty and can briefly exceed a very low police rate. When the exceed-action drops packets, polling becomes intermittent. The correct fix is to raise the police rate for the management class to a value that reflects real SNMP and SSH traffic while keeping CoPP in place to protect the route processor from abuse. Disabling enforcement or moving the policy to the data plane is not appropriate.

Answer

Move the policy-map from the control plane to the data plane interface facing the SNMP server.

Answer

Add a new class-map that matches BGP and apply a lower police rate to it, then reattach the policy.

Answer

Change the exceed-action from drop to transmit so that SNMP packets are never discarded.

Question 9

A Cisco Catalyst 9500 switch is configured for 802.1X with MAC Authentication Bypass (MAB) fallback on a port connected to an IP phone that has a PC daisy-chained behind it. The phone authenticates successfully using 802.1X, but the PC behind the phone fails authentication and is placed in the guest VLAN. The requirement is that the PC be authenticated individually and placed in the data VLAN, while the phone remains in the voice VLAN. Which feature should be configured on the switch port to meet this requirement?

Accepted Answer

Multi-authentication. The daisy-chained PC must be authenticated separately from the phone so it can be placed in the data VLAN while the phone uses the voice VLAN. Cisco multi-authentication (multi-auth) supports multiple independent authentications on one port, including a mix of 802.1X and MAB. Multi-domain supports only one device per domain and multi-host applies the first result to all hosts, so neither meets the requirement.

Answer

Web Authentication (WebAuth) fallback

Answer

Multi-host authentication

Answer

Multi-domain authentication

Question 10

A network architect is designing a Cisco SD-Access fabric. The security team requires that endpoint traffic be segmented into separate virtual networks and that group-based policy be enforced without using traditional VLANs or ACLs between fabric edge nodes. Which two Cisco SD-Access fabric components or features support these requirements? (Choose two.)

Accepted Answer

Cisco TrustSec Security Group Tags (SGTs) enforced by the fabric. SD-Access uses VXLAN encapsulation with a fabric VNI per virtual network to provide data-plane segmentation, and it carries Security Group Tags so that group-based policy can be enforced consistently across fabric edge nodes. Together these deliver segmentation and policy without depending on VLANs or hop-by-hop ACLs between edge switches.

Answer

Private VLANs configured on every fabric edge switch port

Answer

Dynamic ARP Inspection on all fabric underlay links

Answer

Extended ACLs applied inbound on every fabric edge uplink

Question 11

A network engineer is deploying Control Plane Policing on a Cisco IOS XE router that carries eBGP, OSPF, SSH management, and SNMP traffic. The engineer wants to ensure that BGP and OSPF routing updates are never dropped while still rate-limiting SSH and SNMP. Which CoPP configuration approach best meets this requirement?

Accepted Answer

Create separate class-maps for BGP, OSPF, SSH, and SNMP, then apply a policy-map where routing classes use police with a high conform rate and management classes use a lower police rate.. CoPP is designed to classify control-plane traffic into distinct classes and apply independent policers. Separating routing protocols from management protocols allows the engineer to protect BGP and OSPF adjacencies while still enforcing limits on SSH and SNMP. A single class-map or class-default cannot provide this granularity, and an ACL would block rather than rate-limit management traffic.

Answer

Apply a single class-map matching all control-plane traffic and set a single police rate that is high enough for routing protocols.

Answer

Use MQC with a single class-default and configure a priority queue for BGP and OSPF packets.

Answer

Configure an ACL that denies SSH and SNMP to the control plane and apply it inbound on all interfaces.

Question 12

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router that runs BGP, SSH management, and SNMP monitoring. After applying a new CoPP policy, BGP sessions flap intermittently while SSH and SNMP continue to work. The engineer wants to confirm which traffic class is being dropped. Which action should the engineer take?

Accepted Answer

Review CoPP class-map and policy-map statistics with show policy-map control-plane to identify the class with drops.. CoPP applies a policy-map to the control plane and maintains per-class statistics. Because SSH and SNMP still function while BGP flaps, the BGP class is likely exceeding its configured rate. Viewing the control-plane policy-map counters shows which class has drops, pinpointing the class that needs a higher rate or burst value.

Answer

Run show ip bgp summary to check the BGP neighbor state and reset the sessions.

Answer

Capture traffic on the control plane interface using an Embedded Packet Capture with a BGP filter.

Answer

Enable debug ip ssh and debug snmp packets to compare with BGP debugs.

Question 13

A network administrator is configuring IPsec VPN on a Cisco IOS router. The requirement is that the tunnel must support multicast traffic for OSPF neighbor adjacency across the VPN. Which IPsec configuration element is required to meet this requirement?

Accepted Answer

Configure GRE over IPsec.. IPsec security associations are inherently unicast and cannot carry multicast or broadcast traffic. To support OSPF, which relies on multicast hellos, the design must encapsulate multicast inside a GRE tunnel and then protect that GRE tunnel with IPsec. This is commonly called GRE over IPsec or IPsec profile applied to a GRE tunnel interface.

Answer

Use a dynamic VTI with IKEv1.

Answer

Use transport mode instead of tunnel mode.

Answer

Enable IKEv2 with MOBIKE.

Question 14

A network engineer is implementing Control Plane Policing (CoPP) on a Cisco ASR 1000 router to protect the route processor from excessive traffic. The router runs OSPF, BGP, SSH management, and NTP. The engineer wants to ensure that OSPF hello packets are always prioritized and that SSH traffic from the management subnet is rate-limited. Which two statements about the CoPP configuration are true? (Choose two.)

Accepted Answer

CoPP uses a modular QoS CLI policy map applied globally with the 'service-policy' command under control-plane configuration mode.. CoPP uses MQC class maps and policy maps applied under control-plane configuration mode. Class maps reference ACLs to distinguish protocols like OSPF and SSH, allowing differentiated policing and prioritization actions. Applying the policy to physical interfaces or assuming default policies meet custom requirements are common misconceptions.

Answer

CoPP is applied to individual data plane interfaces using the 'service-policy input' command on each physical interface.

Answer

The default CoPP policy that ships with Cisco IOS XE already rate-limits SSH and OSPF traffic without any custom configuration.

Answer

CoPP can only police traffic; it cannot mark or prioritize specific control plane protocols such as OSPF.

Question 15

A network security team deploys Cisco ISE for 802.1X wired authentication. The switches are configured with MAB as a fallback. A printer that does not support 802.1X is connected, but ISE rejects it even though the printer's MAC address is in the correct identity group. The switch port shows the authentication method as MAB and the status as unauthorized. Which configuration issue is the most likely cause?

Accepted Answer

The MAC address format in the ISE endpoint identity group does not match the format sent by the switch in the MAB request.. MAB authentication depends on ISE matching the MAC address sent in the RADIUS request to an endpoint record. If the stored MAC format differs from the format in the Calling-Station-Id attribute, the endpoint is not matched to its identity group and authorization fails. Ensuring consistent MAC formatting resolves the rejection.

Answer

The switch port is configured with authentication host-mode multi-domain instead of multi-auth.

Answer

The RADIUS shared secret on the switch does not match the one configured for the switch in Cisco ISE.

Answer

The switch is configured with dot1x pae authenticator on the port instead of pae supplicant.